IPV6 flow label for stateless handling of IPV4-fragments-in-IPV6

Abstract

A network device may receive, from a first network, a network packet of a first network packet type that encapsulates a fragment of a second network packet of a second network packet type, where the network packet is part of a flow of a plurality of network packets of the first network packet type that encapsulates fragments of the second network packet, and where the network packet includes a flow label that indicates a source port for the second network packet. The network device may perform an anti-spoof check on the fragment of the second network packet based at least in part on the source port for the second network packet that is indicated by the flow label of the network packet. The network device may, based on the fragment passing the anti-spoof check, forward the fragment of the second network packet to a second network.

The invention claimed is: 
     
       1. A method comprising:
 receiving, by a network device from a first network, a network packet of a first network packet type that encapsulates a fragment of a second network packet of a second network packet type, wherein the network packet is part of a flow of a plurality of network packets of the first network packet type that encapsulates fragments of the second network packet, and wherein the network packet includes a flow label that comprises an indication of a source port for the second network packet and an entropy value; 
 in response to receiving the network packet, performing, by the network device, an anti-spoof check on the fragment of the second network packet based at least in part on the source port for the second network packet that is indicated by the flow label; and 
 based on the fragment of the second network packet passing the anti-spoof check, forwarding, by the network device, the fragment of the second network packet to a second network. 
 
     
     
       2. The method of  claim 1 , wherein:
 the network device has not received any fragments of the second network packet that includes an indication of the source port for the second network packet; and 
 the fragment of the second network packet encapsulated by the network packet does not include the indication of the source port for the second network packet. 
 
     
     
       3. The method of  claim 1 , further comprising:
 receiving, by the network device, one or more additional network packets of the flow of the plurality of network packets that encapsulate one or more fragments of the second network packet; 
 in response to receiving each respective network packet of the one or more additional network packets, performing, by the network device, a respective anti-spoof check on a respective fragment of the second network packet encapsulated by the respective network packet based at least in part on the source port for the second network packet that is indicated by a respective flow label of the respective network packet; and 
 based on the respective fragment of the second network packet passing the respective anti-spoof check, forwarding, by the network device, the respective fragment of the second network packet to the second network. 
 
     
     
       4. The method of  claim 1 , wherein the flow label comprises an encrypted source port, further comprising:
 decrypting, by the network device, the encrypted source port to determine the source port for the second network packet. 
 
     
     
       5. The method of  claim 1 , wherein:
 the first network is an Internet Protocol version 6 (IPv6) network; 
 the second network is an Internet Protocol version 4 (IPv4) network; 
 the network packet of the first network packet type is an IPv6 network packet; and 
 the second network packet of the second network packet type is an IPv4 network packet. 
 
     
     
       6. A network device comprising:
 one or more network interfaces configured to receive, from a first network, a network packet of a first network packet type that encapsulates a fragment of a second network packet of a second network packet type, wherein the network packet is part of a flow of a plurality of network packets of the first network packet type that encapsulates fragments of the second network packet, and wherein the network packet includes a flow label that comprises an indication of a source port for the second network packet and an entropy value; and 
 processing circuitry configured to:
 in response to receiving the network packet, perform an anti-spoof check on the fragment of the second network packet based at least in part on the source port for the second network packet that is indicated by the flow label; 
 
 wherein the one or more network interfaces are further configured to, based on the fragment of the second network packet passing the anti-spoof check, forward the fragment of the second network packet to a second network. 
 
     
     
       7. The network device of  claim 6 , wherein:
 the network device has not received any fragments of the second network packet that includes an indication of the source port for the second network packet; and 
 the fragment of the second network packet encapsulated by the network packet does not include the indication of the source port for the second network packet. 
 
     
     
       8. The network device of  claim 6 , wherein:
 the one or more network interfaces are further configured to receive one or more additional network packets of the flow of the plurality of network packets that encapsulate one or more fragments of the second network packet; 
 the processing circuitry is further configured to, in response to receiving each respective network packet of the one or more additional network packets, perform a respective anti-spoof check on a respective fragment of the second network packet encapsulated by the respective network packet based at least in part on the source port for the second network packet that is indicated by a respective flow label of the respective network packet; and 
 the one or more network interfaces are further configured to, based on the respective fragment of the second network packet passing the respective anti-spoof check, forward the respective fragment of the second network packet to the second network. 
 
     
     
       9. The network device of  claim 6 , wherein:
 the flow label comprises an encrypted source port; and 
 the processing circuitry is further configured to decrypt the encrypted source port to determine the source port for the second network packet. 
 
     
     
       10. The network device of  claim 6 , wherein:
 the first network is an Internet Protocol version 6 (IPv6) network; 
 the second network is an Internet Protocol version 4 (IPv4) network; 
 the network packet of the first network packet type is an IPv6 network packet; and 
 the second network packet of the second network packet type is an IPv4 network packet. 
 
     
     
       11. A method comprising:
 receiving, by a network device from a second network, a network packet of a second network packet type; 
 fragmenting, by the network device, the network packet into a plurality of fragments of the network packet; 
 encapsulating, by the network device, the plurality of fragments of the network packet with a plurality of network packets of a first network packet type, including creating, for each of the plurality of network packets, a flow label that includes an entropy value and an indication of a source port of the network packet; and 
 forwarding, by the network device, the plurality of network packets to a first network. 
 
     
     
       12. The method of  claim 11 , wherein creating, for each of the plurality of network packets, the flow label that indicates includes the entropy value and the indication of the source port of the network packet comprises:
 encrypting, by the network device, the source port of the network packet to generate an encrypted source port of the network packet; and 
 creating, by the network device, for each of the plurality of network packets, the flow label that includes the encrypted source port. 
 
     
     
       13. The method of  claim 11 , wherein:
 the first network is an Internet Protocol version 6 (IPv6) network; 
 the second network is an Internet Protocol version 4 (IPv4) network; 
 the plurality of network packets of the first network packet type is a plurality of IPv6 network packets; and 
 the network packet of the second network packet type is an IPv4 network packet. 
 
     
     
       14. A network device comprising:
 one or more network interfaces configured to receive, from a second network, a network packet of a second network packet type; and 
 processing circuitry configured to:
 fragment the network packet into a plurality of fragments of the network packet; and 
 encapsulate the plurality of fragments of the network packet with a plurality of network packets of a first network packet type, including creating, for each of the plurality of network packets, a flow label that includes an entropy value and includes an indication of a source port of the network packet; 
 
 wherein the one or more network interfaces are further configured to forward the plurality of network packets to a first network. 
 
     
     
       15. The network device of  claim 14 , wherein to create, for each of the plurality of network packets, the flow label that indicates includes the entropy value and includes the indication of the source port of the network packet, the processing circuitry is further configured to:
 encrypt the source port of the network packet to generate an encrypted source port of the network packet; and 
 create, for each of the plurality of network packets, the flow label that includes the encrypted source port. 
 
     
     
       16. The network device of  claim 14 , wherein:
 the first network is an Internet Protocol version 6 (IPv6) network; 
 the second network is an Internet Protocol version 4 (IPv4) network; 
 the plurality of network packets of the first network packet type is a plurality of IPv6 network packets; and 
 the network packet of the second network packet type is an IPv4 network packet.